SQL Server

Verify an S/MIME Signed Message

Demonstrates the Chilkat Mime.Verify method, which verifies a CMS/PKCS #7 signed MIME entity and removes the signature wrapper. It takes no arguments and supports both detached (multipart/signed) and opaque (signed-data) messages.

Note: The file paths are relative to the application's current working directory. Absolute paths may also be used. Supply the paths appropriate to your own environment.

Background: Verification confirms two things: that the content was signed by the holder of the signer's certificate, and that it has not been altered since. On success Chilkat strips the signature layer so the object holds the original content, ready to read — effectively "open and check" in one step. A false return means the signature is invalid or the content was tampered with, which is exactly the case your code must not treat as trusted.

Chilkat SQL Server Downloads

Download Chilkat for SQL Server

SQL Server

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    DECLARE @mime int
    EXEC @hr = sp_OACreate 'Chilkat.Mime', @mime OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    EXEC sp_OAMethod @mime, 'LoadMimeFile', @success OUT, 'qa_data/signed.eml'
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @mime, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @mime
        RETURN
      END

    --  Verify the signature and remove the signature wrapper, restoring the underlying content.  Both
    --  detached (multipart/signed) and opaque (CMS signed-data) messages are supported.
    EXEC sp_OAMethod @mime, 'Verify', @success OUT
    IF @success <> 1
      BEGIN

        PRINT 'Signature verification failed.'
        EXEC sp_OAGetProperty @mime, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @mime
        RETURN
      END


    EXEC sp_OAGetProperty @mime, 'NumSignerCerts', @iTmp0 OUT
    PRINT 'Signature verified. Number of signers: ' + @iTmp0

    --  The object now holds the original content with the signature removed.
    DECLARE @body nvarchar(4000)
    EXEC sp_OAMethod @mime, 'GetBodyDecoded', @body OUT
    EXEC sp_OAGetProperty @mime, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 = 0
      BEGIN
        EXEC sp_OAGetProperty @mime, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @mime
        RETURN
      END

    PRINT @body

    EXEC @hr = sp_OADestroy @mime


END
GO